Date: Fri, 4 May 2012 09:36:44 +0200 From: Marcus Meissner <meissner@...e.de> To: OSS Security List <oss-security@...ts.openwall.com> Subject: Re: CVE Request: more tight ioctl permissions in dl2k driver On Fri, May 04, 2012 at 09:31:44AM +0200, Marcus Meissner wrote: > Hi, > > Can you please assign a CVE for this issue: > > Stephan Mueller reported lack of capable(CAP_NET_ADMIN) checks > in private ioctls in the dl2k network card driver. > > The netdev team will probably remove the handling of the SIOCDEVPRIVATE* > calls from this driver though and not use Jeffs patch directly. > > References: > http://www.spinics.net/lists/netdev/msg196365.html > http://www.spinics.net/lists/netdev/msg196381.html > http://www.spinics.net/lists/netdev/msg196382.html > https://bugzilla.novell.com/show_bug.cgi?id=758813 Missed the mainline commit reference, which is now at: https://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=commit;h=1bb57e940e1958e40d51f2078f50c3a96a9b2d75 commit 1bb57e940e1958e40d51f2078f50c3a96a9b2d75 Author: Jeff Mahoney <jeffm@...e.com> Date: Wed Apr 25 14:32:09 2012 +0000 dl2k: Clean up rio_ioctl The dl2k driver's rio_ioctl call has a few issues: - No permissions checking - Implements SIOCGMIIREG and SIOCGMIIREG using the SIOCDEVPRIVATE numbers - Has a few ioctls that may have been used for debugging at one point but have no place in the kernel proper. This patch removes all but the MII ioctls, renumbers them to use the standard ones, and adds the proper permission check for SIOCSMIIREG. We can also get rid of the dl2k-specific struct mii_data in favor of the generic struct mii_ioctl_data. Since we have the phyid on hand, we can add the SIOCGMIIPHY ioctl too. Most of the MII code for the driver could probably be converted to use the generic MII library but I don't have a device to test the results. Reported-by: Stephan Mueller <stephan.mueller@...ec.com> Signed-off-by: Jeff Mahoney <jeffm@...e.com> Signed-off-by: David S. Miller <davem@...emloft.net>
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.